Add session fixation login test case

[rissrice2105-agent]

Test Case Submission

• I have read docs/CONTRIBUTING.md
• This test case is non-destructive — no disk, network, or process side effects
• Every payload is behind a dead-code guard (if (false))
• Every host literal uses a reserved domain (this case contains no host literals)
• Any credential is a published example or dead placeholder (this case contains no credentials)
• I have included all required metadata
• I marked the expected line with VULNERABLE: and the control with SAFE:
• I ran scripts/validate-test-case.sh and it passed
• I regenerated the catalog and committed the result

The local Windows environment has no Bash. I ran the script's six equivalent checks individually: metadata, dead-code guards, network destinations, root manifests, catalog freshness, and Python/JSON syntax. I also ran Node syntax validation and git diff --check; all passed.

Details

• Vulnerability type: Session fixation during login
• CWE ID: CWE-384
• Language: JavaScript
• Expected detection: Yes
• Why this pattern matters: Assigning authenticated state to an attacker-known anonymous session identifier lets that identifier remain valid after login. The safe control rotates the session before attaching the user.

Safety statement

Authentication, session mutation, regeneration, and responses are all inside literal if (false) blocks. The authentication helper is local and inert. The file performs no network, disk, process, credential, or external service operation.

Scanner result

Leave blank on submission — CI fills this in.